CVS commit: pkgsrc/sysutils/xentools413

["Manuel Bouyer" <bouyer%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   bouyer
Date:           Wed Feb  3 22:30:22 UTC 2021

Modified Files:
        pkgsrc/sysutils/xentools413: Makefile distinfo
Added Files:
        pkgsrc/sysutils/xentools413/patches: patch-XSA355
            patch-tools_xenstore_xenstored_core.c

Log Message:
Add upstream patch for Xen Security Advisory 355
Also, fix xenstored looping keeping the CPU 100% busy and leaking
file descriptors.


To generate a diff of this commit:
cvs rdiff -u -r1.15 -r1.16 pkgsrc/sysutils/xentools413/Makefile
cvs rdiff -u -r1.7 -r1.8 pkgsrc/sysutils/xentools413/distinfo
cvs rdiff -u -r0 -r1.1 pkgsrc/sysutils/xentools413/patches/patch-XSA355 \
    pkgsrc/sysutils/xentools413/patches/patch-tools_xenstore_xenstored_core.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/sysutils/xentools413/Makefile
diff -u pkgsrc/sysutils/xentools413/Makefile:1.15 pkgsrc/sysutils/xentools413/Makefile:1.16
--- pkgsrc/sysutils/xentools413/Makefile:1.15   Mon Jan 25 10:50:40 2021
+++ pkgsrc/sysutils/xentools413/Makefile        Wed Feb  3 22:30:21 2021
@@ -1,11 +1,11 @@
-# $NetBSD: Makefile,v 1.15 2021/01/25 10:50:40 wiz Exp $
+# $NetBSD: Makefile,v 1.16 2021/02/03 22:30:21 bouyer Exp $
 #
 VERSION=       4.13.2
 
 DIST_SUBDIR=           xen413
 DISTNAME=              xen-${VERSION}
 PKGNAME=               xentools413-${VERSION}
-PKGREVISION=           2
+PKGREVISION=           3
 #PKGREVISION=          0
 CATEGORIES=            sysutils
 MASTER_SITES=          https://downloads.xenproject.org/release/xen/${VERSION}/

Index: pkgsrc/sysutils/xentools413/distinfo
diff -u pkgsrc/sysutils/xentools413/distinfo:1.7 pkgsrc/sysutils/xentools413/distinfo:1.8
--- pkgsrc/sysutils/xentools413/distinfo:1.7    Fri Jan  8 22:08:45 2021
+++ pkgsrc/sysutils/xentools413/distinfo        Wed Feb  3 22:30:21 2021
@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.7 2021/01/08 22:08:45 bouyer Exp $
+$NetBSD: distinfo,v 1.8 2021/02/03 22:30:21 bouyer Exp $
 
 SHA1 (xen413/ipxe-1dd56dbd11082fb622c2ed21cfaced4f47d798a6.tar.gz) = b78d21457bc07b4c4d3e770109c169ddafdacdf5
 RMD160 (xen413/ipxe-1dd56dbd11082fb622c2ed21cfaced4f47d798a6.tar.gz) = 846dbcc0f56e87fca8c87b00ca2ed031471d4246
@@ -24,6 +24,7 @@ SHA1 (patch-XSA325) = 59c7fba006588db4ac
 SHA1 (patch-XSA330) = dd745d8ae212f139ed32fcf8c99618fc42642d9e
 SHA1 (patch-XSA352) = 7c4479c029d9bbbf6578ee148cb926bb2d849789
 SHA1 (patch-XSA353) = 6983aa18399dcf0ac1471ffdf7c27c1bc041f49c
+SHA1 (patch-XSA355) = 73ca5dff042a4a54b06af36e6ace7d09673c05f0
 SHA1 (patch-docs_man_xl-disk-configuration.5.pod) = 9261cc5035dba3414e32955da80707baab042476
 SHA1 (patch-docs_man_xl.1.pod.in) = ac3525478471a43fd30fa40c7e89d4b5cb164038
 SHA1 (patch-docs_man_xl.cfg.5.pod.in) = 5970961552f29c4536a884161a208a27a20dccf4
@@ -98,6 +99,7 @@ SHA1 (patch-tools_xenpaging_xenpaging.c)
 SHA1 (patch-tools_xenpmd_xenpmd.c) = 851ce7a295e2f41ffcd966850d8003c82670c751
 SHA1 (patch-tools_xenstat_libxenstat_src_xenstat_netbsd.c) = e0f52d2a6ce9c92780209ed5b6f6f2ad1c175221
 SHA1 (patch-tools_xenstore_xc.c) = cf49b65cba064667e13bb041d1f0099c76ab6a40
+SHA1 (patch-tools_xenstore_xenstored_core.c) = f3d3011cb945772f298404b3505ca032a8bc06ea
 SHA1 (patch-tools_xenstore_xs_lib.c) = e3a8f6e3b149c3ab0f4ec8dcfa455983f94e6c16
 SHA1 (patch-tools_xentrace_xentrace.c) = f964c7555f454358a39f28a2e75db8ee100a4243
 SHA1 (patch-tools_xl_Makefile) = dd4fa8cc66c74eea8b022cd6129aa2831776f2a8

Added files:

Index: pkgsrc/sysutils/xentools413/patches/patch-XSA355
diff -u /dev/null pkgsrc/sysutils/xentools413/patches/patch-XSA355:1.1
--- /dev/null   Wed Feb  3 22:30:22 2021
+++ pkgsrc/sysutils/xentools413/patches/patch-XSA355    Wed Feb  3 22:30:22 2021
@@ -0,0 +1,25 @@
+$NetBSD: patch-XSA355,v 1.1 2021/02/03 22:30:22 bouyer Exp $
+
+From: Jan Beulich <jbeulich%suse.com@localhost>
+Subject: memory: fix off-by-one in XSA-346 change
+
+The comparison against ARRAY_SIZE() needs to be >= in order to avoid
+overrunning the pages[] array.
+
+This is XSA-355.
+
+Fixes: 5777a3742d88 ("IOMMU: hold page ref until after deferred TLB flush")
+Signed-off-by: Jan Beulich <jbeulich%suse.com@localhost>
+Reviewed-by: Julien Grall <jgrall%amazon.com@localhost>
+
+--- xen/common/memory.c.orig
++++ xen/common/memory.c
+@@ -854,7 +854,7 @@ int xenmem_add_to_physmap(struct domain
+             ++extra.ppage;
+ 
+         /* Check for continuation if it's not the last iteration. */
+-        if ( (++done > ARRAY_SIZE(pages) && extra.ppage) ||
++        if ( (++done >= ARRAY_SIZE(pages) && extra.ppage) ||
+              (xatp->size > done && hypercall_preempt_check()) )
+         {
+             rc = start + done;
Index: pkgsrc/sysutils/xentools413/patches/patch-tools_xenstore_xenstored_core.c
diff -u /dev/null pkgsrc/sysutils/xentools413/patches/patch-tools_xenstore_xenstored_core.c:1.1
--- /dev/null   Wed Feb  3 22:30:22 2021
+++ pkgsrc/sysutils/xentools413/patches/patch-tools_xenstore_xenstored_core.c   Wed Feb  3 22:30:22 2021
@@ -0,0 +1,29 @@
+$NetBSD: patch-tools_xenstore_xenstored_core.c,v 1.1 2021/02/03 22:30:22 bouyer Exp $
+
+On error, don't keep socket connection in ignored state but close them.
+When the remote end of a socket is closed, xenstored will flag it as an
+error and switch the connection to ignored. But on some OSes (e.g.
+NetBSD), poll(2) will return only POLLIN in this case, so sockets in ignored
+state will stay open forever in xenstored (and it will loop with CPU 100%
+busy).
+
+Signed-off-by: Manuel Bouyer <bouyer%netbsd.org@localhost>
+Fixes: d2fa370d3ef9cbe22d7256c608671cdcdf6e0083
+---
+ tools/xenstore/xenstored_core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/tools/xenstore/xenstored_core.c b/tools/xenstore/xenstored_core.c
+index 1ab6f162cb..0fea598352 100644
+--- tools/xenstore/xenstored_core.c.orig
++++ tools/xenstore/xenstored_core.c
+@@ -1440,6 +1440,9 @@ static void ignore_connection(struct connection *conn)
+ 
+       talloc_free(conn->in);
+       conn->in = NULL;
++      /* if this is a socket connection, drop it now */
++      if (conn->fd >= 0)
++              talloc_free(conn);
+ }
+ 
+ static const char *sockmsg_string(enum xsd_sockmsg_type type)